- How do I install mostafaznv/recaptcha in a Laravel app?
- Install it with composer require mostafaznv/recaptcha, publish the config, and set your site and secret keys in .env. Then add the Blade directive to your forms and attach the recaptcha rule to the relevant FormRequest. Verify composer.json version constraints first, because the last release is from 2021-02-25 and predates Laravel 9/10/11 and PHP 8.1+.
- Does this package support Laravel 9, 10, or 11?
- The last release is dated 2021-02-25, so it predates Laravel 9, 10, and 11 as well as PHP 8.1+. Check the package's composer.json constraints before committing, because a current stack may require a fork and constraint bump rather than a config change. Test installation with composer require without --ignore-platform-reqs to confirm compatibility.
- How does reCAPTCHA v3 validation work in this package?
- The Blade directive renders the site key and JavaScript, the browser produces a short-lived token, and you attach the recaptcha validation rule to a FormRequest. The package then makes a server-to-server HTTPS call to Google's siteverify endpoint using the secret key, which stays server-side. Remember that v3 is score-based and probabilistic, not a deterministic challenge.
- Can I use this package with Inertia, Vue, React, or an API-only Laravel app?
- Yes, but the Blade helpers add less value in those setups. You must generate the reCAPTCHA token on the frontend manually and post it alongside the payload, then validate it server-side with the package rule. The package fits traditional Laravel monoliths and Blade form flows best.
- How do I test forms protected by this package without calling Google?
- Fake the outbound HTTP call with Laravel Http::fake or a Guzzle mock so CI does not depend on Google availability or live keys. The package wraps Google's siteverify endpoint, so that seam should be mocked in your test suite. Treat the validation rule as part of your FormRequest tests and assert both pass and fail paths.
- What happens if Google's reCAPTCHA API times out or returns a non-200 response?
- The package introduces a synchronous outbound dependency on Google inside request handling, so timeout and non-200 behavior matter. You need to determine whether it fails open or fail closed and whether that behavior is configurable. Test this explicitly, because fail-open versus fail-closed is a product decision rather than a package default you should assume.
- Is the reCAPTCHA score threshold configurable per form or only globally?
- The package is config-driven with publishable config and a validation rule. You should verify whether the score threshold is global only or can be set per validation rule or form. For v3 tuning, log scores and adjust thresholds to balance false positives and false negatives. v3 is not a deterministic bot blocker, so layer it with rate limiting and honeypots.
- Is mostafaznv/recaptcha maintained and safe for production?
- It has 21 stars, a single-maintainer profile, and a last release from 2021-02-25, so it is effectively unmaintained for a security-adjacent control. Treat it as code you own rather than a vendor product. Supply-chain risk is low-medium because of the small surface and MIT license, but low community scrutiny means less incidental security review. Consider a maintained fork or a credible successor package.
- Are reCAPTCHA keys validated at Laravel boot or config-cache time?
- The package uses publishable config and .env keys, but you should verify whether misconfiguration surfaces at boot or config-cache time or only at first submission. Add your own config sanity check if deployment safety matters. Otherwise a missing secret may appear as a runtime form failure instead of a startup error.
- What are alternatives to mostafaznv/recaptcha if I need a maintained package?
- You can use Google's google/recaptcha library directly, a maintained Laravel wrapper, or fork and patch this package. The right fallback depends on your Laravel and PHP version and whether you need Blade helpers. For new Laravel 10 or 11 projects, evaluate maintained alternatives before standardizing on this package.